Defender Tampering with my anti-virus?

[Guest]

I'm using Symantec AntiVirus, and Defender is attempting to tamper with it.
So far, it's been blocked (and the only program attempting to tamper with
Symantec). Why is it doing this? Mind you, I'm not a computer expert.

 

[Guest]

I'm using Symantec AntiVirus, and Defender is attempting to tamper with it.
So far, it's been blocked (and the only program attempting to tamper with
Symantec). Why is it doing this? Mind you, I'm not a computer expert.

I'm not a computer expert either, but until recently, I've been running
Norton AV 2005 together with Defender, and Norton's logs were full of
encounters with Defender, and statements that Norton had blocked them. I
presume that Norton sees Defender's behaviour as threatening, while Defender
sees Norton's files as just another set of files that need scanning. As far
as I can tell, this daily battle had no significant effect on the running of
my computer, so if I were you, I wouldn't concern myself about it.

For information, however, I've just got rid of Norton and replaced it with
AVG's new Internet Security suite, and it gets on with Defender as if they
were old pals.

 

[privatenews.microsoft.com]

Symantec is very afraid of any free competitor. They try to buy the
competition so they can put it out of business. In the case of free
competition they are up a tree and try to damage it by turning it off. They
are the worst but not the only one.

At this point I will not use either program as WD is not an easy system for
me on my computer and as a very long term user of Symantec products I no
longer trust them. They are too fat and there are free programs that do what
they do better.

Regards,

 

[robin]

robin smiles <wink>
robin

I'm not a computer expert either, but until recently, I've been running
Norton AV 2005 together with Defender, and Norton's logs were full of
encounters with Defender, and statements that Norton had blocked them. I
presume that Norton sees Defender's behaviour as threatening, while
Defender
sees Norton's files as just another set of files that need scanning. As
far
as I can tell, this daily battle had no significant effect on the running
of
my computer, so if I were you, I wouldn't concern myself about it.

For information, however, I've just got rid of Norton and replaced it with
AVG's new Internet Security suite, and it gets on with Defender as if they
were old pals.

 

[Dave M]

If you were running SpySweeper for example, you'd see that Norton also
detects "tamper" alerts for Webroot's real time protection as it does for
Defender. The problem here is Norton should have included the capability
for a user to specifically ignore scans from other than it's own
Anti-Spyware from these alerts, but that wouldn't be conducive to selling
more Norton. It's obvious that people are free to pick and choose their
own best of breed protections, and Symantec needs to recognize that that's
not always going to be their product that gets picked in this competitive
field. Why tolerate wasted cpu cycles endlessly attempting to examine
Norton files by blocked RTPs?

I eventually got fed up with this nonsense and disabled "protection for my
Symantec product" in AV miscellaneous options, which is something I would
normally not choose to do if the appropriate exclusions were available. It
does silence the reporting process and the inefficiency, although I realize
doing that leaves me potentially more vulnerable. Yet, how would I pick
out a real tamper attempt from thousands of these records generated daily?
Hummm... what to do when renewal time rolls around...

 

[Robin]

get another virus protection other than Norton <g>
heck, you can always trial AVG- they allow you to trial it for a month free
robin

 

[Guest]

get another virus protection other than Norton <g>
heck, you can always trial AVG- they allow you to trial it for a month free

I have a thread going over in 'Announcements' which I'm using as a kind of
'AVG Internet Security Trial diary', in which I'm recording the pros and cons
as I encounter them. Since you know what you're doing, Dave, and I don't, I
expect many of the problems I'm encountering wouldn't be problems for you.
Despite all my cries of anguish, I think the outcome will be that I'll buy a
1 year's subscription for it.

The idea of having the combined complementary package of antivirus, plus
antispyware based on Ewido that happily runs alongside Defender, plus a
firewall that passes all Steve Gibson's tests, all for little more than a 1
year sub for Norton AV (only) is quite attractive!

 

[Dave M]

Thanks for your reply, Alan. Actually, I've been following your experiment
with interest. Another possibility for me is that SpySweeper is combining
forces with Sophos... yes, that's another suite coming and I'm subscribed
into 2008. So I'm content to let the dust settle well into the future
before I have to make any major decisions. The problem is that one month's
darling may turn into next month's dud... I hope these directions are
clearer by the time we get to wherever Security software is currently
headed as it goes after an estimated 12 billion dollar yearly gate
worldwide, and that we don't get trampled on in the rush to the buck.

 

[Guest]

:
Symantec needs to recognize that that's

not always going to be their product that gets picked in this competitive
field. Why tolerate wasted cpu cycles endlessly attempting to examine
Norton files by blocked RTPs?

Dave, you might like to take a glance at my entry today in my 'AVG Internet
Security' thread. It seems that a lot more is going on under the surface of
the AVG/Defender partnership than I'd realised.

 

[Dave M]

I suspect that what you're seeing is the increasing difficulty of creating
a "roll your own" security package. A year ago this wasn't particularly
difficult to do, but with the move toward security suites by the various
vendors it's apparent that that's getting harder to accomplish without side
effects. What I'm not sure about is if that's by design or just as a
result of complexity, although I suspect the former. It makes sense that a
many vendors would like to capture the revenue of having you as a dedicated
customer, so we have Symantec making it harder to use external solutions
with their AV. Ms would love to have you on WLOC as well as Defender,
because they work well together and OneCare is a subscription service.
From what I've read and experienced personally, the list of
incompatibilities is likely to continue growing as these suites evolve.

 

[Robin]

dave and if you need some advice with AVG I can help you too
robin

 

[Dave M]

Thanks... very nice offer, Robin

 

[Guest]

The problem is that Windows Defender is 'interfering with' Symantec
-- that is, it keeps on trying to open Symantec files --
even though I have cited each of them (there are four folders)
under Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations.
That makes this Windows Defender's bug, rather than a
[possible] problem with Symantec or Norton. I agree that
Symantec/Norton should have an 'ignore' list, but,
by offering the option above, Micro$oft claims to HAVE the
corresponding list.

 

[Dave M]

I think we'd have to agree to disagree on this one... the Symantec problem
is not unique to Windows Defender RTP alone, but also occurs with
SpySweeper and who knows what other AS products running RTP (see my
response to your other post.) Therefore, I conclude that Symantec needs to
fix a problem that they created starting with their 2005 release of not
allowing for third party active protection scanners in anyone's security
mix.

What I think we'd both agree on is that this alert is a waste of CPU
cycles, when thousands of alerts and blocks are performed in any given day.
It's basically a shame when consumers are caught in the middle of a rush
for our loyalty and our cash.

--

Regards, Dave

The problem is that Windows Defender is 'interfering with' Symantec
-- that is, it keeps on trying to open Symantec files --
even though I have cited each of them (there are four folders)
under Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations.
That makes this Windows Defender's bug, rather than a
[possible] problem with Symantec or Norton. I agree that
Symantec/Norton should have an 'ignore' list, but,
by offering the option above, Micro$oft claims to HAVE the
corresponding list.

If you were running SpySweeper for example, you'd see that Norton also
detects "tamper" alerts for Webroot's real time protection as it does
for Defender. The problem here is Norton should have included the
capability for a user to specifically ignore scans from other than it's
own Anti-Spyware from these alerts, but that wouldn't be conducive to
selling more Norton. It's obvious that people are free to pick and
choose their own best of breed protections, and Symantec needs to
recognize that that's not always going to be their product that gets
picked in this competitive field. Why tolerate wasted cpu cycles
endlessly attempting to examine Norton files by blocked RTPs?

I eventually got fed up with this nonsense and disabled "protection for
my Symantec product" in AV miscellaneous options, which is something I
would normally not choose to do if the appropriate exclusions were
available. It does silence the reporting process and the inefficiency,
although I realize doing that leaves me potentially more vulnerable.
Yet, how would I pick out a real tamper attempt from thousands of these
records generated daily? Hummm... what to do when renewal time rolls
around...

 

[Guest]

Sorry, I will NOT agree. Micro$oft has provided "Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations", but seems to be
ignoring it. Again, "That makes this Windows Defender's bug", no matter
what additional function we CAN agree Symantec/Norton should provide.

I think we'd have to agree to disagree on this one... the Symantec problem
is not unique to Windows Defender RTP alone, but also occurs with
SpySweeper and who knows what other AS products running RTP (see my
response to your other post.) Therefore, I conclude that Symantec needs to
fix a problem that they created starting with their 2005 release of not
allowing for third party active protection scanners in anyone's security
mix.

What I think we'd both agree on is that this alert is a waste of CPU
cycles, when thousands of alerts and blocks are performed in any given day.
It's basically a shame when consumers are caught in the middle of a rush
for our loyalty and our cash.

--

Regards, Dave

The problem is that Windows Defender is 'interfering with' Symantec
-- that is, it keeps on trying to open Symantec files --
even though I have cited each of them (there are four folders)
under Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations.
That makes this Windows Defender's bug, rather than a
[possible] problem with Symantec or Norton. I agree that
Symantec/Norton should have an 'ignore' list, but,
by offering the option above, Micro$oft claims to HAVE the
corresponding list.

If you were running SpySweeper for example, you'd see that Norton also
detects "tamper" alerts for Webroot's real time protection as it does
for Defender. The problem here is Norton should have included the
capability for a user to specifically ignore scans from other than it's
own Anti-Spyware from these alerts, but that wouldn't be conducive to
selling more Norton. It's obvious that people are free to pick and
choose their own best of breed protections, and Symantec needs to
recognize that that's not always going to be their product that gets
picked in this competitive field. Why tolerate wasted cpu cycles
endlessly attempting to examine Norton files by blocked RTPs?

I eventually got fed up with this nonsense and disabled "protection for
my Symantec product" in AV miscellaneous options, which is something I
would normally not choose to do if the appropriate exclusions were
available. It does silence the reporting process and the inefficiency,
although I realize doing that leaves me potentially more vulnerable.
Yet, how would I pick out a real tamper attempt from thousands of these
records generated daily? Hummm... what to do when renewal time rolls
around...

--

Regards, Dave


PSUSteeler wrote:
I'm using Symantec AntiVirus, and Defender is attempting to tamper with
it. So far, it's been blocked (and the only program attempting to
tamper with Symantec). Why is it doing this? Mind you, I'm not a
computer expert.

 

[Guest]

In desperation with Symantec's technical support (five tech requests and one
long telephone call at my expense):

Not strictly on the mainstream of your threads but having paid for and then
after five NAV 2007 downloads/uninstall/reinstall, etc. using all the 'tools'
Symantec recommend NAV will not install recognising my new subscription [0
days remianing, etc] (the actual program SEEMS to work as it's in NAV 2007
format) my latest advice is uninstall ALL of MS Defender (which I've done
using Control Panel / Remove progs, etc. but there's probably something
remaining). How do I get rid of the remains and then I'll try to
re-download, yet again, another NAV 2007. Apart from advising me to change
AV supplier (!) any ideas? - I dread this time of year as it's the time I
have to renew my NAVs and it takes AGES (non cable connection). I see also
on another thread that the same problem seems to apply to a CD version.

Thanks, Eric

Sorry, I will NOT agree. Micro$oft has provided "Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations", but seems to be
ignoring it. Again, "That makes this Windows Defender's bug", no matter
what additional function we CAN agree Symantec/Norton should provide.

I think we'd have to agree to disagree on this one... the Symantec problem
is not unique to Windows Defender RTP alone, but also occurs with
SpySweeper and who knows what other AS products running RTP (see my
response to your other post.) Therefore, I conclude that Symantec needs to
fix a problem that they created starting with their 2005 release of not
allowing for third party active protection scanners in anyone's security
mix.

What I think we'd both agree on is that this alert is a waste of CPU
cycles, when thousands of alerts and blocks are performed in any given day.
It's basically a shame when consumers are caught in the middle of a rush
for our loyalty and our cash.

--

Regards, Dave

The problem is that Windows Defender is 'interfering with' Symantec
-- that is, it keeps on trying to open Symantec files --
even though I have cited each of them (there are four folders)
under Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations.
That makes this Windows Defender's bug, rather than a
[possible] problem with Symantec or Norton. I agree that
Symantec/Norton should have an 'ignore' list, but,
by offering the option above, Micro$oft claims to HAVE the
corresponding list.

:

If you were running SpySweeper for example, you'd see that Norton also
detects "tamper" alerts for Webroot's real time protection as it does
for Defender. The problem here is Norton should have included the
capability for a user to specifically ignore scans from other than it's
own Anti-Spyware from these alerts, but that wouldn't be conducive to
selling more Norton. It's obvious that people are free to pick and
choose their own best of breed protections, and Symantec needs to
recognize that that's not always going to be their product that gets
picked in this competitive field. Why tolerate wasted cpu cycles
endlessly attempting to examine Norton files by blocked RTPs?

I eventually got fed up with this nonsense and disabled "protection for
my Symantec product" in AV miscellaneous options, which is something I
would normally not choose to do if the appropriate exclusions were
available. It does silence the reporting process and the inefficiency,
although I realize doing that leaves me potentially more vulnerable.
Yet, how would I pick out a real tamper attempt from thousands of these
records generated daily? Hummm... what to do when renewal time rolls
around...

--

Regards, Dave


PSUSteeler wrote:
I'm using Symantec AntiVirus, and Defender is attempting to tamper with
it. So far, it's been blocked (and the only program attempting to
tamper with Symantec). Why is it doing this? Mind you, I'm not a
computer expert.

 

[Guest]

I am NOT currently delving into the internal intricacies of ANY products but
my own, so I cannot be of use to you, Eric. Please note that I believe
Symantec's products are behaving quite properly BASED ON WHAT I KNOW OF
their PUBLISHED RULES. It is Micro$oft's Windows Defender that is
misbehaving. Unfortunately, Dave and Robin (who seem to be more current on
these internals kind of thing) are not responding to that view of the
matter.
I believe this may be encouraging M$ to ignore their culpability, for the
moment.
I agree with them, however, that Symantec (and any other AV producer wanting
to
claim similar high status) should add their own 'ignore this annoyance' lists.

Good luck to us all, and Peace - Hesch

In desperation with Symantec's technical support (five tech requests and one
long telephone call at my expense):

Not strictly on the mainstream of your threads but having paid for and then
after five NAV 2007 downloads/uninstall/reinstall, etc. using all the 'tools'
Symantec recommend NAV will not install recognising my new subscription [0
days remianing, etc] (the actual program SEEMS to work as it's in NAV 2007
format) my latest advice is uninstall ALL of MS Defender (which I've done
using Control Panel / Remove progs, etc. but there's probably something
remaining). How do I get rid of the remains and then I'll try to
re-download, yet again, another NAV 2007. Apart from advising me to change
AV supplier (!) any ideas? - I dread this time of year as it's the time I
have to renew my NAVs and it takes AGES (non cable connection). I see also
on another thread that the same problem seems to apply to a CD version.

Thanks, Eric

Sorry, I will NOT agree. Micro$oft has provided "Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations", but seems to be
ignoring it. Again, "That makes this Windows Defender's bug", no matter
what additional function we CAN agree Symantec/Norton should provide.

< < < < < < earlier text removed - it appears elsewhere
< < < < < < if you think it could POSSIBLY be of interest. - Hesch

 

[Guest]

Thanks Hesch,

Not being a techie I'm not sure I understand all the agendas going on here
and in the previous correpondence. Suffice it to say that, at last, I have
managed to 'enable' my product (with Defender uninstalled) and all seems to
be OK..

Thanks for your response
--
Eric

I am NOT currently delving into the internal intricacies of ANY products but
my own, so I cannot be of use to you, Eric. Please note that I believe
Symantec's products are behaving quite properly BASED ON WHAT I KNOW OF
their PUBLISHED RULES. It is Micro$oft's Windows Defender that is
misbehaving. Unfortunately, Dave and Robin (who seem to be more current on
these internals kind of thing) are not responding to that view of the
matter.
I believe this may be encouraging M$ to ignore their culpability, for the
moment.
I agree with them, however, that Symantec (and any other AV producer wanting
to
claim similar high status) should add their own 'ignore this annoyance' lists.

Good luck to us all, and Peace - Hesch

In desperation with Symantec's technical support (five tech requests and one
long telephone call at my expense):

Not strictly on the mainstream of your threads but having paid for and then
after five NAV 2007 downloads/uninstall/reinstall, etc. using all the 'tools'
Symantec recommend NAV will not install recognising my new subscription [0
days remianing, etc] (the actual program SEEMS to work as it's in NAV 2007
format) my latest advice is uninstall ALL of MS Defender (which I've done
using Control Panel / Remove progs, etc. but there's probably something
remaining). How do I get rid of the remains and then I'll try to
re-download, yet again, another NAV 2007. Apart from advising me to change
AV supplier (!) any ideas? - I dread this time of year as it's the time I
have to renew my NAVs and it takes AGES (non cable connection). I see also
on another thread that the same problem seems to apply to a CD version.

Thanks, Eric

Sorry, I will NOT agree. Micro$oft has provided "Windows Defender's
AdvancedOptions>DoNotScanTheseFilesOrLocations", but seems to be
ignoring it. Again, "That makes this Windows Defender's bug", no matter
what additional function we CAN agree Symantec/Norton should provide.

:

I think we'd have to agree to disagree on this one... the Symantec problem
is not unique to Windows Defender RTP alone, but also occurs with
SpySweeper and who knows what other AS products running RTP (see my
response to your other post.) Therefore, I conclude that Symantec needs to
fix a problem that they created starting with their 2005 release of not
allowing for third party active protection scanners in anyone's security
mix.

What I think we'd both agree on is that this alert is a waste of CPU
cycles, when thousands of alerts and blocks are performed in any given day.
It's basically a shame when consumers are caught in the middle of a rush
for our loyalty and our cash.

< < < < < < earlier text removed - it appears elsewhere
< < < < < < if you think it could POSSIBLY be of interest. - Hesch